FCP Testing and Quality Assurance 2

Question 1

Which FIDO2 test tool is used to verify authenticator conformance before submission to the FIDO Alliance?

Accepted Answer

FIDO Conformance Test Tools (CTT)

Answer

OpenSSL test suite

Answer

WebAuthn Debugger CLI

Answer

CTAP Simulator SDK

Question 2

When testing a FIDO2 authenticator's resident key (discoverable credential) functionality, what is the primary concern?

Accepted Answer

Ensuring the credential is stored on the authenticator and can be listed without a prior user ID

Answer

Verifying the public key is exported correctly to the server

Answer

Confirming the PIN length meets minimum requirements

Answer

Checking that the attestation certificate chain is valid

Question 3

A QA engineer notices that an authenticator returns an aaguid of all zeros in its attestation. What does this indicate?

Accepted Answer

The authenticator is using self-attestation and concealing its model identity

Answer

The authenticator failed the FIDO conformance tests

Answer

The credential was created in CTAP1/U2F mode

Answer

The attestation certificate is expired

Question 4

Which test scenario specifically validates that a relying party rejects a registration response where the clientDataJSON origin does not match the expected origin?

Accepted Answer

Origin binding validation test

Answer

Attestation trust path test

Answer

User presence flag test

Answer

RPID hash mismatch test

Question 5

During CTAP2 interoperability testing, a tester sends a makeCredential command with an unsupported algorithm in pubKeyCredParams. The expected authenticator behavior is to:

Accepted Answer

Return CTAP2_ERR_UNSUPPORTED_ALGORITHM

Answer

Silently ignore the unsupported algorithm and proceed

Answer

Return CTAP2_ERR_INVALID_CBOR

Answer

Close the transport connection

Question 6

What is the purpose of testing the 'up' (user presence) flag in the authenticator data during QA for a FIDO2 implementation?

Accepted Answer

To confirm the authenticator required a physical user interaction before signing

Answer

To verify the user's PIN was correctly validated

Answer

To ensure the credential counter was incremented

Answer

To check the attestation format is packed

Question 7

A test case verifies that an authenticator correctly handles the 'exclude list' in a makeCredential request. What should the authenticator do when a credential in the exclude list is found on the device?

Accepted Answer

Return CTAP2_ERR_CREDENTIAL_EXCLUDED and not create a new credential

Answer

Overwrite the existing credential with a new one

Answer

Return success but include an error flag in the response

Answer

Prompt the user to approve replacement of the existing credential